(19) 



J 



(12) 



Europdisches Patentamt 
European Patent Office 
Office europeen des brevets (1 1 ) 

EUROPEAN PATENT APPLICATION 



nil 

EP 0 775 984 A2 



(43) Date of publication: 

28.05.1997 Bulletin 1997/22 

(21) Application number: 96118648.3 

(22) Date of filing: 20.1 1 .1996 



(51) IntCI. 6 : G07B 17/02 



(84) Designated Contracting States: 


(72) Inventor: Naclerio, Edward J. 


DE FR GB 


Madison, Connect 06443 (US) 


(30) Priority: 21.11.1995 US 560252 


(74) Representative: Avery, Stephen John et al 




Hoffmann, Eltle & Partner, 


(71) Applicant: PITNEY BOWES INC. 


Patent- und Rechtsanwalte, * 


Stamford Connecticut 06926-0700 (US) 


Arabellastrasse 4 




81925 MQnchen (DE) 



00 

o> 
in 

o 

0L 
LU 



(54) Digital postage meter system having a replaceable printing unit with system software 
upgrade 



(57) A postage meter mailing system utilizes a 
meter vault (24) operated under the control of a micro- 
controller (44) mounted in a secure housing. The micro- 
controller (44) of the meter vault (24) has a 
communication device (43) for receiving and transmit- 
ting data messages and non-volatile memory (40, 41) 
for storing program data and other data. A printer (27) is 
utilized for printing a postage indicia. 
The printer (27) operates under the control of a micro- 
controller (66) mounted in a secure housing. The micro- 
controller (66) of the printer (27) has a communication 
device (63) for receiving and transmitting data mes- 
sages and non-volatile memory (61 , 62) for storing pro- 
gram data and other data An interface (23) provides a 



communication path between the meter vault and the 
printer. 

The non-volatile memory (40, 41 ) of the meter vault has 
stored therein a program version number for identifying 
the control program version. The non-volatile memory 
(61, 62) of the printer has stored therein a software 
update number for identifying associated meter vault 
programs which utilize the update software. Upon sys- 
tem start-up, the print head microcontroller (60) 
requests the meter vault microcontroller (44) to transmit 
the control program version and number and deter- 
mines whether the control program requires the update 
software and if so transmits the update software. 
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Description 

The present invention relates to a postage metering 
system that utilizes a digital printer and. more particu- 
larly, to a postage metering system which includes a 
meter vault and a replaceable digital printing unit which 
are physically separated. 

Generally, a postage metering system includes a 
meter vault which accounts for the postage printed by a 
printing unit. The meter vault is comprised of a program- 
mable microcontroller having a program memory for 
storing the system control program data. In an attempt 
to employ digital printers, such as ink-jet, in postage 
metering systems, it has been found that a print module 
configuration which includes the print heads, drivers 
and graphic imaging system within a single secure 
package is desirable. An electronic communication 
channel is provided between the meter vault and the 
print module to allow the communication of critical 
accounting and other data between the meter vault and 
the print module. This channel may also be used to 
allow communication between the print module and a 
mailing machine. 

It is conventional practice to provide system soft- 
ware updates from time to time which either correct soft- 
ware defects, increase system efficiencies or add 
system functionality. Submitting the meter vault to sys- 
tem software updates or modifications has typically 
been accomplished in one of three ways. Under certain 
circumstances the meter vault must be taken out of 
service and returned to the manufacturer where the 
security housing is removed and special equipment is 
used to toad updated software into the program memo- 
ries of the system. If sufficient unallocated program 
memory exists, it may be possible to connect a special 
service device to a communication port of the meter 
vault and down load the updated software into the pro- 
gram memory or other usable non-volatile memory. The 
service device must be specially equipped to preserve 
the security of the meter vault housing and internal cir- 
cuit security of the meter vault. 
Another way is to trade out the existing meter vault with 
a new meter vault. All of these processes represent 
substantial time and cost consequences. 

It is an objective of the present invention to provide 
a convenient means of up-dating the control program 
data for the meter vault and the mailing machine which 
all eviates the time and cost consequences of the con- 
ventional processes. 

A postage meter system in accordance with the 
present invention includes a base unit, more commonly 
referred to as a mailing machine, which serves as a 
platform for the meter unit. The base includes a micro- 
controller system which is responsible for controlling the 
transportation of envelopes in a sequential manner to a 
printing location whereat the printing unit can print a 
postage indicia and any other additional information, 
such as. an ad slogan, delivery address or bar code on 
the envelope. In a preferred configuration, it is contem- 



plated that printing will occur during relative motion 
between the envelope and the printing unit associated 
with the meter. Therefore, the microcontroller system in 
the base will be responsible for relatively precise control 
5 of the motion of the envelope through the printing loca- 
tion. 

The metering is provided by way of two independ- 
ent units which are a vault and a printer. The vault 
accounts for and dispenses funds for postal payment. 

10 Communication between the mailing machine, vault and 
printer is facilitated through a printer interface unit. The 
meter vault communicates with the print head to transfer 
encrypted messages for postage amount, piece count, 
and dgital tokens. A digital token represents an alpha- 

75 numeric sequence generated by using any suitable 
algorithm which uniquely identifies the postage indicia 
as originating from a particular postage meter system 
and verifying that that postage meter system is author- 
ized for use by the Postal Authorities. Meter vault com- 

20 munications are routed to the print head through the 
printer interface. The meter vault securely communi- 
cates with the print head using any suitable digital 
encryption technique. 

The printer interface serves as a junction board for 

25 the mailing machine, meter vault, slogan box, and print 
head. This minimizes the number of connection points 
in the system. The printer interface provides the con- 
nections for a serial communication linkage and unreg- 
ulated DC power from the mailing machine to the meter 

30 vault, transfers print command and status signals 
between the mailing machine and print head, interfaces 
the slogan box to the print head, supports a unique 
serial link between the meter vault and print head, and 
regulates logic and print nozzle power from the mailing 

35 machine to the print head. 

The slogan box stores graphics images represent- 
ing the fixed part of the standard indicia (e.g., the eagle 
printed on US mail), low-value indicia, permit mail indi- 
cia, town circle (where appropriate), inscriptions, and 

40 customer slogans. It also stores the fonts for printing the 
variable data on the mail piece. All of the graphics data 
is either encrypted or signed, that is, subject to other 
types of encoding algorithms in the slogan box non-vol- 
atile memory. The encryption or signing is done at the 

45 manufactures' facility. Only the print head contains the 
necessary decryption key to properly interpret the data. 

The communication by the meter vault includes 
encrypted information. Only the meter vault and the 
print head know the proper keys to utilize the informa- 

50 tion. The keys are stored in an ASIC (Application Spe- 
cific Integrated Circuit) on the print head to reduce the 
opportunity for fraud. The microcontroller on the print 
head controls the printing operation including loading of 
NVM (Non Volatile Memory), decoding of messages 

55 with assistance of a DES (Data Encryption Standard) 
engine on the print head ASIC, and initiating of printing. 
The microcontroller helps to reduce the complexity of 
the ASIC. 

The print head ASIC decodes the mail position for 
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printer sequencing, provides the proper timing for driv- 
ing the print nozzles, supports externa! ink supply mon- 
itoring, interfaces to the NVM; support external 
communications, and performs self-test functions. The 
print head NVM also stores inscription representations. 5 
The meter vault stores a table of enabled inscriptions. 
When the operator at the mailing machine wishes to 
select an inscription, the print head transfers a list of the 
available options to the meter vault The vault screens 
for only the enabled inscription s and sends the irtforma- 10 
tion to the mailing machine. The operator's response is 
forwarded from the meter vault to the print head. 

As part of the system start-up process, the print 
head issues a message to the meter vault which directs 
the meter vault microcontroller to receive updated pro- 15 
gram data, only if, that updated program data version 
has not already been written to the non-volatile memory 
of the meter vault The print head then encrypts the 
' updated program data and transmits that encrypted 
data to the meter vault. The microcontroller of the meter 20 
vault then decrypts the updated program data and 
stores the data in the nonvolatile memory of the meter 
vault. The program update code is loaded into the print 
module after fabrication by the manufacture and prior to 
shipment. 25 
In the accompanying drawings: 

Fig. 1 is a schematic of a postage metering system 
in accordance with one embodiment of the present 
invention; 30 
Fig. 2 is a schematic illustration of a communication 
path between the meter vault mailing machine and 
print head units and of the respective control sys- 
tems in accordance with an embodiment of the 
present invention; 35 
Fig. 3 is a process diagram of the start-up process 
of the postage meter system in accordance with an 
embodiment of the present invention; 
Fig. 4 is a process diagram of the slogan selection 
process of the postage meter system in accordance 40 
with an embodiment of the present invention; and 
Fig. 5 is a process diagram for mail processing of 
the postage meter system in accordance with an 
embodiment of the present invention. 

45 

Referring to Fig. 1 , a postage meter system, gener- 
ally indicated as 11, includes a mailing machine base 
12. The mailing machine base 12 is of any suitable con- 
ventional design and, in the preferred embodiment, 
includes a feeder section 13, singulator 14 and scale so 
section 15 positioned serially along a mail flow path. 
Following the scale section 15 is a print station at loca- 
tion A which is followed by a stacker 17. Any suitably 
designed feeder section 1 3, singulator section 14, scale 
section 15 and stacker section 17 may be used. The 55 
operation of the respective sections 13, 14, 15, and 17 
is under the control of a mailing machine controller 21 . 
Power to the system is provided by a conventional 
power supply 19. It should be appreciated that the mail- 



ing machine controller 21 , in the preferred embodiment, 
will control such additional functional systems as the 
operator keyboard and display, unsecured departmental 
accounting (not shown) and other conventional system 
functions. As depicted in Fig. 1. a programmable read 
only rates memory (PROM 22) is detachably mounted 
to the mailing machine controller 21 to provide rate 
information to the mailing machine controller in any suit- 
able conventional manner. 

Also, housed in the mailing machine is a printer 
interface 23, slogan box 25, meter vault 24 and print 
head/controller 27, hereafter referred to as print head 
27. 

The print head 27 is mounted to rails 30 and 31 by any 
suitable means to be positionable, by any convention 
means such as by a motor (not shown) between a first 
position "A" which is the print position, a second position 
"B" which is a tape print position, and a third position "C" 
which is a cleaning position. At position "C" the print 
head 27 is brought into contact with a nozzle cleaning 
system of any suitable design such that, for example, 
where ink jet print technology is utilized by the print 
head 27, the nozzles may by cleaned. The positioning of 
the print head 27 along the rails 30 and 31 is under the 
control of the mailing machine controller utilizing any 
suitable conventional control means. 

Also, the mailing machine 12 includes provision for 
allowing the external connection of an external interface 
unit (EIU 26) to the printer interface 23 by any conven- 
tional means. The EIU 26 provides additional micro- 
processing functionality to the system 1 1 utilizing any 
suitable method. 

Referring to Fig. 2, the meter vault 24 includes 
source accounting memory 40 and 41 , program mem- 
ory 42, ASIC 43, CPU controller 44, and keyboard/dis- 
play 45. As more specifically described subsequently, 
the ASIC 43 provides two RS-232 communications 
ports 46 in any suitable conventional means for facilitat- 
ing communications with the mailing machine 21 . 

The communication port 46 is modified to include 
an extra pin for receiving DC power from the mailing 
machine. 

ft should be appreciated that the keyboard and display 
45 provides an operator or postal agent a means of 
recharging the accounting registers of the accounting 
memory 40 and 41 through the keyboard in any suitable 
conventional manner. 

The mailing machine controller 21 is comprised of a 
controller CPU 50, code ROM 51. code RAM 52, user 
input/output 53, motor controller 54, and sensor control- 
ler 55. Also provided is a scale interface 56 and UART 
interface 57. The UART interlace 57 is of any conven- 
tional design for allowing asynchronous serial commu- 
nication. Of principle concern to the preferred 
embodiment of the present invention is that the UART 
interface facilitates communication between the mailing 
machine controller 21 and the other system units 23, 24, 
25, 26 and 27. 

The print head 27 is comprised of a CPU controller 
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60, nonvolatile memory units 61 and 62, ASIC 63 and 
print units 64, 65, 66. In the preferred embodiment it is 
contemplated to use multiple ink jet printing units. 

Meter vault 24 communications to the print head 27 
are routed through the printer interface 23 along com- s 
munication path P47. The meter vault 24 securely com- 
municates with the print head 27 using DES encryption. 
A number of encryption keys are preloaded Into the 
ASIC 63 of the print head 27 and ASIC 43 of the meter 
vault 24. This will make discovering the keys impossible 10 
without reverse engineering of the ASIC 43 or 63. Com- 
munications path 47 is also used to select Inscriptions 
and slogans in conjunction with the slogan box 25. A 
printer interface path P46 provided for electrical com- 
munication with the EIU 26. As aforenoted, the ElU 26 15 
represents an external unit which can be attached to the 
meter vault 24 to provide enhanced capability to the 
meter vault 24 when the meter vault 13 is used in com- 
bination with the featured mailing machine. 1 ' 

The printer interface 23 serves as a junction board 20 
for the mailing machine 21, meter vault 24, print head 
27 and a slogan box 25. By providing specific communi- 
cation paths P13, P14, P17, P37, P46, P47 and P57 
within the printer interface 23. the individual subsystems 
can be isolated in such a manner to remove the neces- 25 
sity for interdependent security measures. 

The slogan box 25 stores graphics images repre- 
senting the fixed part of the standard indicia (e.g., the 
eagle printed on US mail), low-value indicia, permit mail 
indicia, town circle (where appropriate), inscriptions, 30 
and slogans. It also stores the fonts for printing the var- 
iable data on the mail piece. All of the graphics data is 
either encrypted or signed in the slogan box 25 non-vol- 
atile memory (not shown). Only the print head 27 con- 
tains the necessary decryption key to properly interpret 35 
the data. Because of the different indicia formats, each 
country will have its own indicia graphics, therefore its 
own slogan box 25 product code number. 

When a new print head 27 is positioned in the mail- 
ing machine 17, the controller 21 checks the local NVM 40 
61 and 62; if it is un-initialized. the controller reads the 
slogan box 25 to retrieve the necessary graphics infor- 
mation. The print head 27 decrypts or verifies this data 
and programs it into its NVM 61 and 62. In the event that 
the print head NVM 61 and 62 are smaller than the slo- 45 
gan box NVM, only the subset of graphics necessary for 
a particular mail run is loaded into the print head NVM 
61 and 62. If the NVM 61 and 62 should become cor- 
rupted, ag., fail a checksum test, the controller 60 can 
request a new memory download as though it were so 
newly installed. 

When the mailing machine microcontroller 21 initi- 
ates the meter ad selection option as a result of opera- 
tor selection via the user 1/0 53, the slogan box 25 will 
transfer a text description of each of its slogans to the 55 
mailing machine microcontroller 21 through the print 
head 27 and meter vault 24. Once the operator 
responds with the selected slogan to print by selection 
of the appropriate operator key on the mailing machine 



11, the slogan box 25 transfers the bit-map slogan 
image to the print head 27 if it is not already loaded in 
the print head NVM 61 and 62. 
The slogan box 25 electrically connects to the print 
head 27. 

The print head 27 prints the indicia including post- 
age amount, digital tokens, piece count, and date as 
welt as an optional inscription and slogan on each mail 
piece. The fixed part of the image, fonts for the variable 
parts of the image, and inscription bit-maps are pro- 
grammed into the print head's NVM 61 and 62 when the 
print head is first installed in the mailing machine 17. 
The meter vault 24 will send a message to the print 
head 27 indicating the format of the town circle. The 
print head 27 obtains the town circle information as 
either a text string from the meter vault 24 or a bit map 
from the slogan box and programs its NVM with the 
data. For each mail piece, the meter vault 24 transfers 
the variable indicia information such as the postage 
amount, digital tokens, meter serial number, and piece 
count to the print head 27. The print head controller 60 
programs registers (not shown) in the ASIC 63 with this 
information. When the mailing machine microcontroller 
21 commands the print head 27 to print, the ASIC 63 
combines the fixed and variable parts of the image for 
printing by the print units 64, 65 and 66 utilizing any suit- 
able technique. 

The interface with the meter vault 24 includes encrypted 
information; only the meter vault 24 and the print head 
27 know the proper keys to utilize the information. The 
keys are stored in an ASIC 63 on the print head 27 and 
the meter vault ASIC 43. 

The controller 60 on the print head 27 controls the print- 
ing operation including loading of NVM 61 and 62, 
decoding of messages and initiating of printing. 

The print head ASIC 63 also decodes the mail posi- 
tion for printer sequencing, provides the proper timing 
for driving the print nozzles, supports external ink sup- 
ply monitoring, interfaces to the NVM 61 and 62; sup- 
ports external communications, and performs serf-test 
functions. 

The print head NVM 61 and 62 also stores inscription 
representations. The meter vault 24 stores a table of 
enabled inscriptions when the operator at the mailing 
machine 11 wishes to select an inscription, the print 
head 27 transfers a list of the available options to the 
meter vault 24. The vault 24 screens for only the ena- 
bled inscriptions and sends the information to the mail- 
ing machine microcontroller 21 . The operator response 
is forwarded from the meter vault 24 to the print head 
27. 

Referring also to Figs. 3, 4 and 5, it is observed that 
the meter vault 24 may have any suitable known inde- 
pendent housing and internal security measures as well 
as the print head 27 may like-wise have independent 
housing and any suitable internal security since critical 
communication between the mailing machine controller 
21 , meter vault 24 and print head 27 are secure commu- 
nications. 
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Particularly, referring to Figs. 3, 4 and 5, during the sys- 
tem start-up process, the print head 27 generates a ran- 
dom number which is then encrypted by the ASIC 63. 
The random number is transmitted via path P47 in the 
encrypted and clear form to the meter vault 24. The 
meter vault 24 decrypts the random number and com- 
pares with the dear text. If a match is determined, then 
the meter vault 24 generates a message of critical data 
including the random number. The meter vault message 
is encrypted and transmitted along path P47 to the print 
head 27. The message is then decrypted and, if the ran- 
dom number transmitted matches the generated ran- 
dom number, the encrypted information is stored in 
NVM 61 and 62 for use in subsequent printing. The print 
head 27 then transmits a request to the meter vault 24 
along path P47 to send the program software version 
number. In response, the meter vault 24 sends the soft- 
ware version number along path P47 which is received 
by the print head 27 and compared to a software ver- 
sion number stored in the nonvolatile memory 61 or 62 
of the print head 27. If the version number transmitted to 
the print head 27 is equal to or greater than the version 
number stored in the non-volatile memory 61 or 62 of 
the print head 27 then the system is ready for normal 
operation. If the version number transmitted to the print 
head 27 is less than the version number stored in the 
non-volatile memory 61 or 62 then the print head 27 
transmits the updated program data to the meter vault 
24 which stores the updated program data in its non- 
volatile memory 40 or 41 . The system is new ready for 
normal operation. 

Particularly referring to Fig. 4, in the manner 
described above, an operator may submit a query to the 
slogan box 25 for available slogans via paths P14 and 
P47. 

The slogan box 25 transmits the slogan descriptor infor- 
mation via path 47 to the meter vault 24 which masks 
the unusable postal inscriptions. The meter vault 24 
than relays the modified message to the mailing 
machine controller 21 for presentation to the requester. 
The requester then makes a selection which the mailing 
machine controller 21 transmits via path P1 7, P57 to the 
slogan box 25. The slogan box 25 then transmits the 
data for the graphic image via path P57 to the print head 
27 which stores the graphic information in the memories 
61 and 62. 

The print head 27 then transmits via path P1 7 the infor- 
mation received to the mailing machine controller 21 . 

Referring now to Fig. 5, to process mail items, a 
postage value is either operator selected or determined 
based upon data from the scale 15 via the scale inter- 
face 56. The mailing machine controller 21 transmits the 
appropriate postage value to the meter vault 24 via path 
P14 which then accounts for the postage value. The 
meter vault 24 then encrypts the critical accounting data 
and transmit the encrypted data via path P47 to the print 
head 27 where the data is decrypted. Once the data is 
successfully decrypted, the print head 27 transmits an 
OK to print message to the mailing machine controller 



8 

21 via path PI 7. Upon receipt of the OK message from 
the print head 27, mailing machine controller 21 then 
transmits along path P17 a print enable and printing is 
commenced. 

s ft should now be appreciated that the afore 
described system provides the benefit of unlacing sys- 
tem security and provides a method of generating 
secure communications between system units. 

10 Claims 

1 . A postage meter mailing system, having: 

a meter vault (24) including a microcontroller 
is (44), said microcontroller of said meter v^ult 

(24) having a communication means (43) for 
receiving and transmitting data messages and 

a memory (40. 41) for storing program data; 

* * * * * 

20 a printer (27) including a microcontroller (60), 

said microcontroller of said printer having a 
communication means (63) for receiving and 
transmitting data messages and a memory (61 , 
62) for storing program data; 

25 

interface means (23) for providing a communi- 
cation path between said meter vault (24) and 
said printer (27); 

30 said memory (40, 41) of said meter vault (24) 

having program version identification means 
stored therein for identifying a program data 
version; 

35 said memory (61, 62) of said printer (27) hav- 

ing stored therein program update data and 
meter vault program identification means for 
identifying associated program data versions; 
said print head microcontroller (60) having 

40 means for requesting said meter vault micro- 

controller (44) to transmit said program data 
version and for determining whether said pro- 
gram data version is associated with said meter 
vault program identification means and for 

45 transmitting said update data to said meter 

vault (24) only if said determination is valid. 

2. A postage meter mailing system, having 

so a meter vault (24) including a microcontroller 

(44), said microcontroller of said meter vault 
having a communication means (43) for receiv- 
ing and transmitting data messages and a 
memory (40, 41) for storing program data, 

55 

a printer (27) including a microcontroller (60). 
said microcontroller of said printer having a 
communication means (63) for receiving and 
transmitting data messages and a memory (61 , 
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62) for storing program data; 

interface means (23) for providing a communi- 
cation path between said meter vault and said 
printer, said memory (40, 41) of said meter s 
vault (24) having stored therein data represent- 
ing a numeric version of said program data; 

said memory (61, 62) of said printer (27) hav- 
ing stored therein program update data and a w 
data representing an associated numeric ver- 
sion for identifying associated program data; 

said print head microcontroller (60) having 
means for requesting said meter vault micro- 15 
controller (44) to transmit said data represent- 
ing said numeric version of said program data 
and comparing said data representing said 
' numeric version with said data representing 
said associated numeric versions wherein, only 20 
if said numeric version is less than said associ- 
ated numeric version, said print head micro- 
controller (60) transmits said update data to 
said meter vault (24). 

25 

A method of updating program software of a post- 
age meter system having a meter vault (24) includ- 
ing a microcontroller (44), said microcontroller of 
said meter vault having a communication means 
(44) for receiving and transmitting data messages 30 
and a memory (40, 41) for storing program data, 

a printer (27) including a microcontroller (60), 
said microcontroller of said printer having a 
communication means for receiving and trans- 35 
mitting data messages and a memory (61, 62) 
for storing program data; and 

interface means (23) for providing a communi- 
cation path between said meter vault and said 40 
printer, 

the method comprising: 

storing numericdata in said memory (40, 41) of 45 
said meter vault (24) representative of said pro- 
gram data version, 

storing program update data in said memory 
(61 . 62) of said printer (27), so 

storing associated numeric data in said mem- 
ory (61, 62) of said printer (27) representative 
said program data version associated with said 
program update data, ss 

comparing said associated numeric data in 
said printer memory (61, 62) to said numeric 
data in said meter vault memory (40, 41), and 



transmitting said update data to said meter 
vault, only if, said associated numeric data is 
greater than said numeric data. 

4. A method of updating a program software as 
claimed in Claim 3 further comprising the step of 
setting a transfer bit in said printer memory (61 , 62) 
the first time said comparison is made. 

5. A method of updating a program software as 
claimed in Claim 4 further comprising the step of 
first checking said transfer bit and if set aborting 
said method. 

6. A postage metering system of the type having a 
meter vault (24) including a memory for storing a 
meter vault software program having a version 
number, wherein the improvement comprises: 

means for determining the version number of 
the meter vault software program; 

means for comparing the detected version 
number with a desired version number; and 

means for transmitting a new meter vault soft- 
ware program to the meter vault if the meter 
vault version number is earlier in sequence 
than a desired version number. 

7. The postage meter system of claim 6, wherein the 
determining means is operable to determine the 
version number of the meter vault software program 
during a start-up routine for the postage meter sys- 
tem. 

8. The postage meter system of claim 7, further com- 
prising: 

a printer, and 

interface means for providing communication 
between the meter vault and the printer; and 

wherein the new meter vault software 
program is located in a memory of the printer. 
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